An adversarial defense method for deep learning models for signal modulation recognition
By improving the residual network of the deep learning model, injecting Gaussian noise and using radial basis function activation, and combining the PGD adversarial training algorithm to optimize the model, the problems of unstable defense effect and complex strategy were solved, and the accuracy and robustness of signal modulation recognition were improved.
Patent Information
- Application Number
- CN202411502215.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-25
- Publication Date
- 2025-10-28
- Estimated Expiration
- 2044-10-25
AI Technical Summary
Existing methods for defending against adversarial attacks struggle to balance defensive effectiveness with model performance, resulting in unstable defenses and complex strategies. Furthermore, the issue of diverse adversarial examples remains unresolved.
A defense identification model based on a deep learning model is constructed. The model is optimized by improving the residual network, injecting Gaussian noise and using radial basis function activation function, combined with PGD adversarial training algorithm, and the final model is determined by feature evaluation and threshold setting, replacing or integrating the unoptimized model.
It significantly improved the model's recognition accuracy when facing FGSM attacks, enhanced its defense against adversarial attacks, improved the model's learning and generalization capabilities, and achieved a more stable defense effect.
Smart Images
Figure CN119441878B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of deep learning technology, and in particular to an adversarial defense method for a deep learning model for signal modulation recognition. Background Technology
[0002] With the widespread application of deep neural networks (DNNs) in fields such as computer vision, speech recognition, and natural language processing, their security issues have gradually attracted attention. Adversarial attacks, by introducing subtle perturbations into the input signal, can cause significant deviations in the output of DNNs, affecting the accuracy and reliability of the model.
[0003] Existing methods for defending against adversarial attacks include, but are not limited to, adversarial training, model structure modification, and the use of randomness and projection to eliminate adversarial perturbations. However, these methods often fail to achieve an ideal balance between defensive effectiveness and model performance, resulting in unstable defensive effects, complex defensive strategies, and the diversity of adversarial examples. Summary of the Invention
[0004] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide an adversarial defense method for deep learning models used for signal modulation recognition. This invention solves the problems of unstable defense effects and complex defense measurement in existing adversarial attack defense methods.
[0005] To achieve the above objectives, the present invention provides the following solution:
[0006] An adversarial defense method for a deep learning model for signal modulation recognition, comprising:
[0007] The modulation data of the signal to be identified is acquired and preprocessed to obtain the input sample data.
[0008] The input sample is fed into the defense recognition model to obtain the recognition result;
[0009] The construction process of the defense identification model is as follows:
[0010] A first defense identification sub-model is constructed based on a deep learning model;
[0011] The second defense identification sub-model is obtained by improving the residual network of the first defense identification sub-model based on the transmission equation theory.
[0012] Gaussian noise is injected into the second defense recognition sub-model to obtain the third defense recognition sub-model;
[0013] The defense identification model is obtained based on the third defense identification sub-model and the radial basis function.
[0014] Preferably, the input sample data is obtained by acquiring the modulation data of the signal to be identified and performing preprocessing, including:
[0015] The modulated data of the signal to be identified is denoised to obtain denoised data.
[0016] The denoised data is then subjected to signal filtering to obtain the input sample data.
[0017] Preferably, it further includes:
[0018] Obtain adversarial samples and training samples for the original defense recognition model;
[0019] According to the PGD adversarial training algorithm, the defense identification sub-model is optimized in real time using the adversarial samples and the training samples to obtain the optimized defense identification sub-model.
[0020] The optimized defense identification sub-model is used to replace or integrate the current unoptimized model.
[0021] Preferably, the optimized defense identification sub-model is used to replace or integrate the current unoptimized model, including:
[0022] Obtain the data features of the input samples and the data features of historical input samples;
[0023] The importance of the data features of the input sample and the data features of the historical input sample is evaluated using the optimized defense identification sub-model and the current unoptimized model to obtain a first evaluation result and a second evaluation result;
[0024] A threshold is set and the final defense identification model is determined based on the results of the first and second assessments.
[0025] Preferably, setting a threshold and determining the final defense identification model based on the results of the first and second evaluations includes:
[0026] Determine the threshold;
[0027] If the first evaluation result is greater than the threshold, while the second evaluation result is less than the threshold, then the current model is replaced with the optimized defense recognition model.
[0028] If both the first evaluation result and the second evaluation result are higher than the threshold, then either the two models are retained or model fusion is performed.
[0029] If both the first evaluation result and the second evaluation result are below the threshold, then the results are re-evaluated or the model is integrated.
[0030] Preferably, the expression for the final defense recognition model is:
[0031] ydef =y opt (1-e -kT )+Ce -kT ;
[0032] Among them, y def For the defense identification model, y opt For the optimized output, k is the transmission speed constant, T is the time parameter, and Ce is the value of the output. -kT This is the attenuation factor.
[0033] The present invention discloses the following technical effects:
[0034] This invention provides an adversarial defense method for a deep learning model used for signal modulation recognition, comprising: acquiring signal modulation data to be recognized and preprocessing it to obtain input sample data; inputting the input samples into a defense recognition model to obtain a recognition result; the construction process of the defense recognition model is as follows: constructing a first defense recognition sub-model based on a deep learning model; improving the residual network of the first defense recognition sub-model according to the transfer equation theory to obtain a second defense recognition sub-model; injecting Gaussian noise into the second defense recognition sub-model to obtain a third defense recognition sub-model; and obtaining a defense recognition model based on the third defense recognition sub-model and radial basis functions. This invention uses a radial basis function (RBF) activation function to replace the traditional softmax activation function to enhance the learning and generalization capabilities of the deep learning model. By utilizing the powerful interpolation capability of RBF, this activation function can achieve accurate function approximation in high-dimensional space, significantly improving the model's ability to recognize complex data patterns and its generalization performance when training data is insufficient. When facing FGSM attacks, the model using the RBF interpolation activation function has a significantly improved recognition accuracy compared to the model using softmax, further enhancing the model's ability to resist adversarial attacks. Attached Figure Description
[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0036] Figure 1 This is a flowchart of an adversarial defense method for a deep learning model used for signal modulation recognition, provided in an embodiment of the present invention. Detailed Implementation
[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.
[0038] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0039] like Figure 1 As shown, this invention provides an adversarial defense method for deep learning models used in signal modulation recognition, comprising:
[0040] Step 100: Acquire the modulation data of the signal to be identified and perform preprocessing to obtain the input sample data;
[0041] Step 200: Input the input sample into the defense recognition model to obtain the recognition result;
[0042] Specifically, signal modulation data refers to the raw data of the signal to be identified. This data is typically generated using a modulation technique, such as frequency modulation (FM), amplitude modulation (AM), or phase modulation (PM). Signal modulation data can be time-domain waveforms, frequency-domain representations, or other forms of signal samples. Recognition result: This is the output of the deep learning model after processing the input sample data, usually a classification of the signal modulation method. The recognition result can be a label (such as "AM," "FM," "PM," etc.) or a probability distribution representing the probability that the input signal belongs to each modulation method.
[0043] The construction process of the defense identification model is as follows:
[0044] Step 201: Construct the first defense identification sub-model based on the deep learning model;
[0045] Step 202: Improve the residual network of the first defense identification sub-model according to the transmission equation theory to obtain the second defense identification sub-model;
[0046] Step 203: Inject Gaussian noise into the second defense recognition sub-model to obtain the third defense recognition sub-model;
[0047] Step 204: Obtain the defense identification model based on the third defense identification sub-model and the radial basis function.
[0048] Furthermore, the modulation data of the signal to be identified is acquired and preprocessed to obtain input sample data, including:
[0049] The modulated data of the signal to be identified is denoised to obtain denoised data.
[0050] The denoised data is then subjected to signal filtering to obtain the input sample data.
[0051] Specifically, an autoencoder is used for feature denoising to reduce the original noise components in the data; an adaptive bandpass filter is used to improve signal quality, filter out irrelevant noise, and retain key information to resist disturbances.
[0052] More specifically, the input data is first denoised using an autoencoder, which consists of an encoder and a decoder. The encoder maps the input data to a low-dimensional feature space, and the decoder reconstructs a clean signal. During training, Gaussian noise is injected into the signal to minimize the reconstruction error. An adaptive bandpass filter is then used to filter the signal. The filtering process is represented by a parameterized impulse response, and the filter parameters are dynamically adjusted according to the signal characteristics to enhance signal quality while preserving key information in adversarial samples.
[0053] By modeling the output of each layer of a deep neural network (such as ResNet) as a feature of the transport equation, and introducing a diffusion term to simulate the propagation and diffusion behavior of signals in the network, adversarial robustness is enhanced. Gaussian noise with a specific variance is injected into the output of each residual map to smooth the feature space and reduce the impact of adversarial perturbations.
[0054] Radial basis function (RBF) interpolation activation is used instead of the traditional softmax function to enhance the model's ability to learn and represent complex data patterns. RBF interpolation activation is applied to the model's output layer, with RBF centers set using feature points from the training data and corresponding weights calculated.
[0055] RBF interpolation activation can achieve accurate and smooth function approximation in high-dimensional space, thereby improving the stability of the model when facing adversarial attacks.
[0056] Furthermore, it also includes:
[0057] Obtain adversarial samples and training samples for the original defense recognition model;
[0058] According to the PGD adversarial training algorithm, the defense identification sub-model is optimized in real time using the adversarial samples and the training samples to obtain the optimized defense identification sub-model.
[0059] The optimized defense identification sub-model is used to replace or integrate the current unoptimized model.
[0060] Specifically, the PGD adversarial training algorithm uses generated adversarial examples alongside the original samples for training, improving the model's robustness against both natural and adversarial examples. A multi-level Monte Carlo algorithm is used for joint training, optimizing linear activation and RBF interpolation activation separately to enhance the model's generalization ability and stability.
[0061] Furthermore, the optimized defense identification sub-model is used to replace or integrate the current unoptimized model, including:
[0062] Obtain the data features of the input samples and the data features of historical input samples;
[0063] The importance of the data features of the input sample and the data features of the historical input sample is evaluated using the optimized defense identification sub-model and the current unoptimized model to obtain a first evaluation result and a second evaluation result;
[0064] A threshold is set and the final defense identification model is determined based on the results of the first and second assessments.
[0065] Specifically, real-time input sample data is collected, which can come from network traffic, user behavior, system logs, etc. For each sample, feature extraction is performed using feature engineering techniques, which may include the following steps: Data cleaning: removing duplicates, missing values, and outliers.
[0066] Feature selection: Select features that are highly relevant to the target task from the initially extracted features.
[0067] Standardization / Normalization: Standardize feature values to a specific range (e.g., 0 to 1) to improve the training performance of the model.
[0068] Reviewing historical data samples, which are typically data collected over a period of time, can be used for model training and performance benchmarking.
[0069] Similar to the data processing of the current input sample, the same feature extraction process is performed on each historical sample.
[0070] The features of the current input sample and the features of historical samples are respectively fed into the optimized defense recognition sub-model. Importance scores are calculated based on the model output and the corresponding features. Common methods include: SHAP value: measures the importance of each feature to the model output; LIME: Locally Interpretable Model-Agnostic method, which evaluates feature importance based on a locally linear model. The first evaluation result is recorded. Similar steps are followed to evaluate the input sample and historical samples using the current unoptimized model, and the second evaluation result is recorded.
[0071] Based on business needs and system characteristics, one or more thresholds are set to determine the strength of the evaluation results. For example, a reasonable threshold can be determined based on practical experience or through cross-validation. The threshold can be calculated based on the distribution of the model output or the quantiles of the feature evaluation results.
[0072] Through the above steps, the system can effectively extract and evaluate features from real-time input samples and historical data, perform importance analysis using the model's output, provide a basis for decision-making in the defense identification model, and assist in subsequent security strategies and adjustments. The entire process is easy to iterate and adjust to continuously improve the model's performance and defense capabilities.
[0073] Furthermore, setting thresholds and determining the final defense identification model based on the results of the first and second evaluations includes:
[0074] Determine the threshold;
[0075] If the first evaluation result is greater than the threshold, while the second evaluation result is less than the threshold, then the current model is replaced with the optimized defense recognition model.
[0076] If both the first evaluation result and the second evaluation result are higher than the threshold, then either the two models are retained or model fusion is performed.
[0077] If both the first evaluation result and the second evaluation result are below the threshold, then the results are re-evaluated or the model is integrated.
[0078] Specifically, the final expression for the defense recognition model is:
[0079] y def =y opt (1-e -kT )+Ce -kT ;
[0080] Among them, y def For the defense identification model, y opt For the optimized output, k is the transmission speed constant, T is the time parameter, and Ce is the value of the output. -kT This is the attenuation factor.
[0081] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0082] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. An adversarial defense method for a deep learning model used for signal modulation recognition, characterized in that, include: The modulation data of the signal to be identified is acquired and preprocessed to obtain the input sample data. The input sample is fed into the defense recognition model to obtain the recognition result; The construction process of the defense identification model is as follows: A first defense identification sub-model is constructed based on a deep learning model; The second defense identification sub-model is obtained by improving the residual network of the first defense identification sub-model based on the transmission equation theory. Gaussian noise is injected into the second defense recognition sub-model to obtain the third defense recognition sub-model; The defense identification model is obtained based on the third defense identification sub-model and the radial basis function.
2. The adversarial defense method for a deep learning model for signal modulation recognition according to claim 1, characterized in that, The input sample data is obtained by acquiring the modulation data of the signal to be identified and preprocessing it, including: The modulated data of the signal to be identified is denoised to obtain denoised data. The denoised data is then subjected to signal filtering to obtain the input sample data.
3. The adversarial defense method for a deep learning model for signal modulation recognition according to claim 1, characterized in that, Also includes: Obtain adversarial samples and training samples for the original defense recognition model; According to the PGD adversarial training algorithm, the defense identification sub-model is optimized in real time using the adversarial samples and the training samples to obtain the optimized defense identification sub-model. The optimized defense identification sub-model is used to replace or integrate the current unoptimized model.
4. The adversarial defense method for a deep learning model for signal modulation recognition according to claim 3, characterized in that, The optimized defense identification sub-model replaces or integrates the current unoptimized model, including: Obtain the data features of the input samples and the data features of historical input samples; The importance of the data features of the input sample and the data features of the historical input sample is evaluated using the optimized defense identification sub-model and the current unoptimized model to obtain a first evaluation result and a second evaluation result; A threshold is set and the final defense identification model is determined based on the results of the first and second assessments.
5. The adversarial defense method for a deep learning model for signal modulation recognition according to claim 4, characterized in that, Setting a threshold and determining the final defense identification model based on the results of the first and second evaluations, including: Determine the threshold; If the first evaluation result is greater than the threshold, while the second evaluation result is less than the threshold, then the current model is replaced with the optimized defense recognition model. If both the first evaluation result and the second evaluation result are higher than the threshold, then either the two models are retained or model fusion is performed. If both the first evaluation result and the second evaluation result are below the threshold, then the results are re-evaluated or the model is integrated.
6. The adversarial defense method for a deep learning model for signal modulation recognition according to claim 4, characterized in that, The final expression for the defense recognition model is: y def =y opt 1-e -kT +What -kT ; Among them, y def For the defense identification model, y opt For the optimized output, k is the transmission speed constant, T is the time parameter, and Ce is the value of the output. -kT This is the attenuation factor.